CVE-2026-4039 | OpenClaw 2026.2.19-2 Skill Env applySkillConfigenvOverrides code injection (GHSA-82g8-464f-2mv7)

A vulnerability was found in OpenClaw 2026.2.19-2. It has been declared as critical. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection.

This vulnerability is registered as CVE-2026-4039. It is possible to launch the attack remotely. No exploit is available.

It is recommended to upgrade the affected component.